feat: update controls in the admin, release token scope, build info in CI images [CI]

The versions page shows each node's update state with update buttons, API
tokens get a release scope that can only register releases (used by CI), and
the CI image and release builds now pass the tag, commit and build time.

backend/tests/Monitor.Backend.Tests/UpdateTests.cs

@@ -67,6 +67,40 @@ public sealed class UpdateTests
         Assert.Contains(anonymous.StatusCode, new[] { HttpStatusCode.Unauthorized, HttpStatusCode.Forbidden });
     }
 
+    [Fact]
+    public async Task ReleaseToken_CanOnlyRegisterReleases_AndAReadTokenCannotEvenDoThat()
+    {
+        async Task<string> NewTokenAsync(string scope)
+        {
+            using HttpResponseMessage created = await _backend.Admin.PostAsync("/api/admin/api-tokens", BackendFixture.Json(new JsonObject { ["name"] = _backend.UniqueName("ci"), ["scope"] = scope }));
+            Assert.Equal(HttpStatusCode.Created, created.StatusCode);
+            return JsonNode.Parse(await created.Content.ReadAsStringAsync())!["plaintext"]!.GetValue<string>();
+        }
+
+        HttpClient Client(string token)
+        {
+            var client = new HttpClient { BaseAddress = _backend.BaseAddress };
+            client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+            return client;
+        }
+
+        long seq = TimeProvider.System.GetUtcNow().ToUnixTimeSeconds() * 1000 + 50;
+        using HttpClient release = Client(await NewTokenAsync("release"));
+        using HttpClient read = Client(await NewTokenAsync("read"));
+        var body = BackendFixture.Json(new JsonObject { ["manifest"] = Manifest("probe", seq), ["signature"] = "MEUC" });
+
+        using HttpResponseMessage forbidden = await read.PostAsync("/api/admin/releases", BackendFixture.Json(new JsonObject { ["manifest"] = Manifest("probe", seq), ["signature"] = "MEUC" }));
+        Assert.Equal(HttpStatusCode.Forbidden, forbidden.StatusCode);
+        using HttpResponseMessage published = await release.PostAsync("/api/admin/releases", body);
+        Assert.Equal(HttpStatusCode.Created, published.StatusCode);
+
+        // release 令牌只能登记发布清单：读不了任何东西，也不能做别的管理操作
+        Assert.Equal(HttpStatusCode.Forbidden, (await release.GetAsync("/api/admin/agents")).StatusCode);
+        Assert.Equal(HttpStatusCode.Forbidden, (await release.GetAsync("/api/admin/releases")).StatusCode);
+        Assert.Equal(HttpStatusCode.Forbidden, (await release.PostAsync("/api/admin/nodes/agt_x/update", null)).StatusCode);
+        Assert.Equal(HttpStatusCode.Unauthorized, (await _backend.Anonymous.PostAsync("/api/admin/releases", BackendFixture.Json(new JsonObject { ["manifest"] = Manifest("probe", seq + 1), ["signature"] = "MEUC" }))).StatusCode);
+    }
+
     [Fact]
     public async Task UpdateRequest_ReachesTheNode_AndItsReportedStatusShowsInBuildInfo()
     {